Privacy Policy — ZephyrFit
This page covers ZephyrFit. ZephyrRun is designed differently and has its own policy.
Zephyr Lab (“Zephyr Lab,” “we,” “us,” or “our”) operates ZephyrFit and ZephyrRun. This Privacy Policy explains what information our apps access or collect, how that information is processed and stored, and the choices you have when using ZephyrFit or ZephyrRun (collectively, the “Services”).
ZephyrFit and ZephyrRun are designed differently. ZephyrFit is a cloud-backed service that stores fitness data you choose to provide or sync. ZephyrRun processes your fitness and activity data locally on your device and does not upload that data to Zephyr Lab.
If you do not agree with this Privacy Policy, please do not use the Services.
Data We Collect
Account Information
When you create or use a ZephyrFit account, we may collect:
- your email address
- your name
- login method information, such as Sign in with Apple if you use it
Fitness Data
ZephyrFit is a fitness data recording and analytics app. We collect and store the fitness data you choose to create, import, or sync through ZephyrFit, including information such as:
- workouts and workout sessions
- meals, food entries, and macro goals
- body measurements
- notes and related fitness records
Device Health Data
If you enable device health integrations, ZephyrFit may access health and fitness data on your device according to the permissions you grant, including:
- workout and activity data such as running, cycling, and strength training records
- body measurement data such as weight and body fat percentage
Where supported and authorized by you, ZephyrFit may also write certain data back to your device health platform.
You can control these permissions through your device settings.
If you wish to remove previously imported health data from ZephyrFit, we recommend turning off the integration within ZephyrFit before revoking access through your device settings. Revoking device permission alone prevents future access but may not delete data that you previously imported into ZephyrFit.
Technical and Support Information
We may also receive:
- connection and request metadata such as IP address and basic network information
- device and app information needed to operate and secure ZephyrFit
- information you send us when you contact support
How We Use ZephyrFit Data
We use information collected through ZephyrFit to:
- create and manage your account
- authenticate you
- store and sync your fitness data
- provide features and analytics requested by you
- provide customer support
- secure the service, prevent abuse, and troubleshoot issues
- maintain and improve ZephyrFit
We do not sell your personal information.
We do not use your personal information, including data imported from Apple Health or Android Health Connect, for advertising, marketing, or data brokerage purposes.
How ZephyrFit Stores Data
ZephyrFit is a cloud-backed service. Fitness data that you choose to record, import, or sync is stored on ZephyrFit’s servers so that we can provide synchronization and core app functionality.
ZephyrFit separates account identity and fitness data across different systems.
- The account system stores account-related information such as login and account data.
- The fitness system stores fitness records associated with a randomly generated identifier rather than directly labeling those records with your identity.
This design is intended to reduce direct linkage between identity and fitness records in storage. This is pseudonymization, not anonymity.
Strict Mode
ZephyrFit offers an optional feature called Strict Mode.
When Strict Mode is enabled:
- linkage credentials are encrypted on your device before being sent to ZephyrFit
- your PIN is not sent to or stored by ZephyrFit
- ZephyrFit cannot decrypt those credentials without your PIN
Strict Mode does not mean that all fitness data is end-to-end encrypted. ZephyrFit still processes and stores account and fitness data on its servers to provide synchronization and core app functionality.
If you forget your vault PIN, you may lose access to your fitness data. We cannot recover your PIN for you.
ZephyrFit Data Retention
We keep live account data and live fitness data until you request deletion or until your account is otherwise removed.
We do not intentionally keep long-term logs beyond what is reasonably necessary to operate, secure, and troubleshoot ZephyrFit, although system software and infrastructure may generate temporary logs automatically.
We create database backup snapshots for operational and recovery purposes. Deleted data may remain in backup snapshots for an extended period and may not be removed immediately from those backups.
When we process an account deletion request, we aim to remove your live account data and live fitness data from our production systems, subject to legitimate retention needs such as security, fraud prevention, legal compliance, and backup recovery limitations.
Third Parties and Service Providers
For cloud-backed portions of our Services, we may use third-party service providers to operate infrastructure and supporting functions.
ZephyrFit currently uses service providers including:
- Cloudflare for network routing, security, and related infrastructure functions
- Resend for email verification and email delivery
These providers may process limited personal information as necessary to provide their services.
Data Location
Our core network and server infrastructure for cloud-backed services is hosted in Canada.
Some service providers may process limited information in other countries depending on how their infrastructure operates. As a result, information processed through our cloud-backed services may be processed in jurisdictions outside your province, state, or country.
Your Rights and Choices
For personal information held by Zephyr Lab, you may request access to, correction of, or deletion of your personal information by contacting support-privacy@zephyrfit.ca.
Legal Basis
Where applicable law requires a legal basis for processing, we process personal information as necessary to provide the Services you request, based on your consent where applicable, and for legitimate interests such as operating, securing, and maintaining our Services.
Children
ZephyrFit and ZephyrRun are not directed to children under 13, and we do not knowingly collect personal information from children under 13.
If you believe a child under 13 has provided personal information to us, please contact us at support-privacy@zephyrfit.ca and we will take appropriate action.
Changes to This Policy
We may update this Privacy Policy from time to time.
If we make material changes, we may update the “Last updated” date above and take other reasonable steps to notify users where appropriate.
Contact
If you have questions about this Privacy Policy or want to make a privacy-related request regarding information held by Zephyr Lab, contact support-privacy@zephyrfit.ca.